Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title chromium-browser security update
Informations
Name DSA-4330 First vendor Publication 2018-11-02
Vendor Debian Last vendor Modification 2018-11-02
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Several vulnerabilities have been discovered in the chromium web browser.

CVE-2018-5179

Yannic Boneberger discovered an error in the ServiceWorker implementation.

CVE-2018-17462

Ned Williamson and Niklas Baumstark discovered a way to escape the sandbox.

CVE-2018-17463

Ned Williamson and Niklas Baumstark discovered a remote code execution issue in the v8 javascript library.

CVE-2018-17464

xisigr discovered a URL spoofing issue.

CVE-2018-17465

Lin Zuojian discovered a use-after-free issue in the v8 javascript library.

CVE-2018-17466

Omair discovered a memory corruption issue in the angle library.

CVE-2018-17467

Khalil Zhani discovered a URL spoofing issue.

CVE-2018-17468

Jams Lee discovered an information disclosure issue.

CVE-2018-17469

Zhen Zhou discovered a buffer overflow issue in the pdfium library.

CVE-2018-17470

Zhe Jin discovered a memory corruption issue in the GPU backend implementation.

CVE-2018-17471

Lnyas Zhang discovered an issue with the full screen user interface.

CVE-2018-17473

Khalil Zhani discovered a URL spoofing issue.

CVE-2018-17474

Zhe Jin discovered a use-after-free issue.

CVE-2018-17475

Vladimir Metnew discovered a URL spoofing issue.

CVE-2018-17476

Khalil Zhani discovered an issue with the full screen user interface.

CVE-2018-17477

Aaron Muir Hamilton discovered a user interface spoofing issue in the extensions pane.

This update also fixes a buffer overflow in the embedded lcms library included with chromium.

For the stable distribution (stretch), these problems have been fixed in version 70.0.3538.67-1~deb9u1.

We recommend that you upgrade your chromium-browser packages.

For the detailed security status of chromium-browser please refer to its security tracker page at: https://security-tracker.debian.org/tracker/chromium-browser

Original Source

Url : http://www.debian.org/security/2018/dsa-4330

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-416 Use After Free
22 % CWE-125 Out-of-bounds Read
11 % CWE-787 Out-of-bounds Write (CWE/SANS Top 25)
11 % CWE-459 Incomplete Cleanup
11 % CWE-200 Information Exposure
11 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration

TypeDescriptionCount
Application